Problem Statement
Why is native Java serialization considered risky in modern systems, and what safer alternatives can you use?
Explanation
Deserialization can trigger gadget chains leading to remote code execution when untrusted data is accepted; the object graph is opaque, brittle across versions, and slow. Safer options: JSON or CBOR with vetted mappers, ProtoBuf/Avro/FlatBuffers for schema-driven, version-tolerant formats, or dedicated DTOs with explicit parsing. If you must deserialize, enable object filters (JEP 290), restrict classes, and do input validation.
